profclaw 2.3.0 → 2.4.0

package/dist/agents/receipt/receipt-view.js

@@ -0,0 +1,227 @@
+/**
+ * Receipt viewer: a terminal summary and a self-contained single-file HTML page
+ * (inline CSS and JS, no external assets). Every piece of receipt data is
+ * HTML-escaped, and a CSP meta tag blocks anything not inline.
+ */
+import { createHash } from 'node:crypto';
+export function buildReceiptModel(events) {
+    const model = { attempts: [], files: [] };
+    const byAttempt = new Map();
+    const view = (n) => {
+        let a = byAttempt.get(n);
+        if (!a) {
+            a = { attempt: n, toolCalls: [], rollbacks: [] };
+            byAttempt.set(n, a);
+            model.attempts.push(a);
+        }
+        return a;
+    };
+    for (const e of events) {
+        switch (e.type) {
+            case 'run_start':
+                model.start = e.data;
+                model.startedAt = e.ts;
+                break;
+            case 'attempt_start':
+                view(e.data.attempt).model = e.data.model;
+                break;
+            case 'tool_call':
+                view(e.data.attempt).toolCalls.push(e.data);
+                break;
+            case 'file_change':
+                model.files.push(e.data);
+                break;
+            case 'verifier_result':
+                if (e.data.attempt === 0)
+                    model.baseline = e.data;
+                else
+                    view(e.data.attempt).verifier = e.data;
+                break;
+            case 'usage': {
+                const a = view(e.data.attempt);
+                a.usage = e.data;
+                if (!a.model && e.data.model)
+                    a.model = e.data.model;
+                break;
+            }
+            case 'rollback':
+                view(e.data.attempt).rollbacks.push(e.data);
+                break;
+            case 'attempt_end':
+                view(e.data.attempt).end = e.data;
+                break;
+            case 'run_end':
+                model.end = e.data;
+                model.endedAt = e.ts;
+                break;
+        }
+    }
+    return model;
+}
+const usd = (n) => `$${n.toFixed(4)}`;
+// Terminal
+export function renderTerminalSummary(events, verify) {
+    const m = buildReceiptModel(events);
+    const out = [];
+    if (verify)
+        out.push(`Integrity: ${verify.ok ? 'OK' : 'FAILED'}. ${verify.message}`, '');
+    if (m.start) {
+        out.push(`Goal:     ${m.start.goal}`);
+        out.push(`Verifier: ${m.start.verifyCommand}`);
+        out.push(`Branch:   ${m.start.branch}${m.start.repoHead ? ` (from ${m.start.repoHead.slice(0, 12)})` : ''}`);
+        out.push(`Tool:     ${m.start.tool.name} ${m.start.tool.version}`);
+    }
+    if (m.end) {
+        out.push(`Result:   ${m.end.verified ? 'VERIFIED' : 'NOT VERIFIED'} (${m.end.stopReason}), ${m.end.totals.attempts} attempt(s), ${m.end.totals.totalTokens} tokens, ${usd(m.end.totals.costUsd)}`);
+    }
+    else {
+        out.push('Result:   incomplete (no run_end)');
+    }
+    if (m.baseline)
+        out.push(`Baseline: ${m.baseline.passed ? 'pass' : `fail (score ${m.baseline.failureScore})`}`);
+    out.push('');
+    for (const a of m.attempts) {
+        const bits = [`Attempt ${a.attempt}: ${a.end?.outcome ?? 'unfinished'}`];
+        if (a.model)
+            bits.push(a.model);
+        if (a.verifier)
+            bits.push(`verifier ${a.verifier.passed ? 'pass' : `fail (score ${a.verifier.failureScore})`}`);
+        if (a.toolCalls.length)
+            bits.push(`${a.toolCalls.length} tool call(s)`);
+        if (a.usage)
+            bits.push(`${a.usage.totalTokens} tokens, ${usd(a.usage.costUsd)}`);
+        for (const r of a.rollbacks)
+            bits.push(`rolled back: ${r.reason}`);
+        out.push(bits.join(', '));
+    }
+    if (m.files.length) {
+        out.push('', 'Files changed:');
+        for (const f of m.files)
+            out.push(`  ${f.status} ${f.path}`);
+    }
+    return out.join('\n') + '\n';
+}
+// HTML
+export function escapeHtml(input) {
+    return input
+        .replace(/&/g, '&')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#39;');
+}
+const CSS = `
+:root{color-scheme:light dark;--bg:#fff;--fg:#1a1a1a;--mut:#666;--line:#ddd;--ok:#127a3a;--bad:#b3261e;--warn:#8a5a00;--code:#f5f5f5}
+@media(prefers-color-scheme:dark){:root{--bg:#141414;--fg:#e8e8e8;--mut:#9a9a9a;--line:#333;--ok:#5fd08a;--bad:#ff8a80;--warn:#e0b050;--code:#1e1e1e}}
+body{font:14px/1.5 system-ui,sans-serif;background:var(--bg);color:var(--fg);margin:0 auto;padding:16px;max-width:960px}
+h1{font-size:20px;margin:0 0 4px}h2{font-size:16px;margin:24px 0 8px}
+.mut{color:var(--mut)}.ok{color:var(--ok)}.bad{color:var(--bad)}.warn{color:var(--warn)}
+.card{border:1px solid var(--line);border-radius:6px;padding:10px 12px;margin:8px 0}
+.row{display:flex;flex-wrap:wrap;gap:4px 16px}
+pre{background:var(--code);padding:8px;overflow:auto;border-radius:4px;margin:6px 0;font:12px/1.4 ui-monospace,monospace;white-space:pre-wrap;word-break:break-word}
+.add{color:var(--ok)}.del{color:var(--bad)}.hunk{color:var(--mut)}
+details>summary{cursor:pointer}
+table{border-collapse:collapse;width:100%}td,th{text-align:left;padding:2px 8px 2px 0;border-bottom:1px solid var(--line);font-size:13px}
+button{font:inherit;padding:2px 8px}
+`;
+const JS = `
+document.getElementById('expand').addEventListener('click',function(){
+  var open=this.getAttribute('data-open')!=='1';
+  document.querySelectorAll('details').forEach(function(d){d.open=open});
+  this.setAttribute('data-open',open?'1':'0');
+  this.textContent=open?'Collapse all':'Expand all';
+});
+`;
+const cspHash = (s) => `'sha256-${createHash('sha256').update(s, 'utf-8').digest('base64')}'`;
+function diffHtml(diff) {
+    return diff
+        .split('\n')
+        .map((line) => {
+        const cls = line.startsWith('+') && !line.startsWith('+++')
+            ? 'add'
+            : line.startsWith('-') && !line.startsWith('---')
+                ? 'del'
+                : line.startsWith('@@')
+                    ? 'hunk'
+                    : '';
+        const text = escapeHtml(line);
+        return cls ? `<span class="${cls}">${text}</span>` : text;
+    })
+        .join('\n');
+}
+function verifierHtml(v, label) {
+    const cls = v.passed ? 'ok' : 'bad';
+    return `<details><summary>${escapeHtml(label)}: <span class="${cls}">${v.passed ? 'PASS' : 'FAIL'}</span>, exit ${v.exitCode === null ? 'n/a' : escapeHtml(String(v.exitCode))}, score ${escapeHtml(String(v.failureScore))}${v.timedOut ? ', timed out' : ''}</summary><pre>${escapeHtml(v.output)}</pre></details>`;
+}
+export function renderHtml(events, verify) {
+    const m = buildReceiptModel(events);
+    const p = [];
+    const title = m.start ? `Run receipt: ${m.start.goal}` : 'Run receipt';
+    p.push(`<h1>${escapeHtml(title.length > 120 ? `${title.slice(0, 117)}...` : title)}</h1>`);
+    if (verify) {
+        p.push(`<div class="card"><strong class="${verify.ok ? 'ok' : 'bad'}">Integrity: ${verify.ok ? 'OK' : 'FAILED'}</strong> <span class="mut">${escapeHtml(verify.message)}</span>${verify.signature.present ? ` <span class="${verify.signature.valid ? 'ok' : 'bad'}">signature ${verify.signature.valid ? 'valid' : 'invalid'}</span>` : ' <span class="mut">unsigned</span>'}${verify.signature.publicKey ? `<div class="mut">key ${escapeHtml(verify.signature.publicKey.slice(-24))}</div>` : ''}${verify.lastHash ? `<div class="mut">last hash ${escapeHtml(verify.lastHash)}</div>` : ''}</div>`);
+    }
+    else {
+        p.push('<div class="card mut">Integrity was not checked for this view.</div>');
+    }
+    if (m.start) {
+        p.push(`<div class="card"><div class="row"><span>Verifier <code>${escapeHtml(m.start.verifyCommand)}</code></span><span>Branch <code>${escapeHtml(m.start.branch)}</code></span>` +
+            `<span>Head <code>${escapeHtml(m.start.repoHead ?? 'unknown')}</code></span><span>${escapeHtml(m.start.tool.name)} ${escapeHtml(m.start.tool.version)}</span></div></div>`);
+    }
+    if (m.end) {
+        p.push(`<div class="card"><strong class="${m.end.verified ? 'ok' : 'bad'}">${m.end.verified ? 'VERIFIED' : 'NOT VERIFIED'}</strong> (${escapeHtml(m.end.stopReason)})` +
+            `<div class="row mut"><span>${escapeHtml(String(m.end.totals.attempts))} attempt(s)</span><span>${escapeHtml(String(m.end.totals.totalTokens))} tokens</span>` +
+            `<span>cost ${escapeHtml(usd(m.end.totals.costUsd))}</span><span>${escapeHtml(String(m.end.totals.filesChanged))} file(s) changed</span></div></div>`);
+    }
+    else {
+        p.push('<div class="card warn">Incomplete: no run_end event.</div>');
+    }
+    p.push('<h2>Timeline</h2><button id="expand" type="button" data-open="0">Expand all</button>');
+    if (m.baseline)
+        p.push(`<div class="card">${verifierHtml(m.baseline, 'Baseline (before any attempt)')}</div>`);
+    for (const a of m.attempts) {
+        const outcome = a.end?.outcome ?? 'unfinished';
+        const cls = outcome === 'verified' ? 'ok' : outcome === 'improved' || outcome === 'unchanged' ? 'warn' : 'bad';
+        const head = [`<strong>Attempt ${escapeHtml(String(a.attempt))}</strong>`, `<span class="${cls}">${escapeHtml(outcome)}</span>`];
+        if (a.model)
+            head.push(`<span class="mut">${escapeHtml(a.model)}</span>`);
+        if (a.usage)
+            head.push(`<span class="mut">${escapeHtml(String(a.usage.totalTokens))} tokens, ${escapeHtml(usd(a.usage.costUsd))}</span>`);
+        const body = [];
+        if (a.toolCalls.length) {
+            body.push(`<details><summary>${escapeHtml(String(a.toolCalls.length))} tool call(s)</summary><table><tr><th>Tool</th><th>Args</th><th>ms</th><th>ok</th></tr>` +
+                a.toolCalls
+                    .map((t) => `<tr><td>${escapeHtml(t.name)}</td><td>${escapeHtml(t.argsSummary)}${t.redacted ? ' <span class="warn">(redacted)</span>' : ''}</td><td>${escapeHtml(String(Math.round(t.durationMs)))}</td><td class="${t.ok ? 'ok' : 'bad'}">${t.ok ? 'yes' : 'no'}</td></tr>`)
+                    .join('') +
+                '</table></details>');
+        }
+        if (a.verifier)
+            body.push(verifierHtml(a.verifier, 'Verifier'));
+        for (const r of a.rollbacks)
+            body.push(`<div class="bad">Rolled back: ${escapeHtml(r.reason)}</div>`);
+        p.push(`<div class="card"><div class="row">${head.join('')}</div>${body.join('')}</div>`);
+    }
+    p.push('<h2>Diff</h2>');
+    if (m.files.length === 0)
+        p.push('<div class="mut">No files changed.</div>');
+    for (const f of m.files) {
+        const label = `${escapeHtml(f.status)} <code>${escapeHtml(f.path)}</code>`;
+        const detail = f.diff !== undefined
+            ? `<pre>${diffHtml(f.diff)}</pre>`
+            : `<div class="mut">Diff omitted. sha256 ${escapeHtml(f.diffSha256)}</div>`;
+        p.push(`<div class="card"><details open><summary>${label}${f.diffTruncated ? ' <span class="warn">(truncated)</span>' : ''}</summary>${detail}</details></div>`);
+    }
+    const csp = `default-src 'none'; style-src ${cspHash(CSS)}; script-src ${cspHash(JS)}; base-uri 'none'; form-action 'none'`;
+    return [
+        '<!doctype html>',
+        '<html lang="en"><head><meta charset="utf-8">',
+        `<meta http-equiv="Content-Security-Policy" content="${escapeHtml(csp)}">`,
+        '<meta name="viewport" content="width=device-width,initial-scale=1">',
+        `<title>${escapeHtml(title.slice(0, 120))}</title>`,
+        `<style>${CSS}</style></head><body>`,
+        p.join('\n'),
+        `<script>${JS}</script></body></html>`,
+        '',
+    ].join('\n');
+}
+//# sourceMappingURL=receipt-view.js.map

package/dist/agents/receipt/receipt-writer.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Receipt writer: append-only JSONL, canonical JSON, SHA-256 hash chaining,
+ * secret redaction before hashing, optional Ed25519 signature on run_end.
+ * Spec: docs/specs/run-receipt-v0.md
+ */
+import type { ReceiptDataMap, ReceiptEvent, ReceiptEventType, ReceiptSink } from './receipt-types.js';
+/** Sorted keys, no whitespace, `undefined` members dropped, non-finite numbers rejected. */
+export declare function canonicalJson(value: unknown): string;
+export declare function sha256Hex(input: string | Uint8Array): string;
+/** Hash of an event: canonical JSON without `hash` and `signature`. */
+export declare function computeEventHash(event: Record<string, unknown>): string;
+export declare const REDACTED = "[REDACTED]";
+export declare function redactString(input: string): string;
+/** Deep-redacts strings and values under secret-looking object keys. Returns the changed flag. */
+export declare function redactValue(value: unknown): {
+    value: unknown;
+    changed: boolean;
+};
+export interface ReceiptSigner {
+    publicKey: string;
+    sign(hash: string): string;
+}
+/** Signer from a PKCS8 PEM Ed25519 private key. */
+export declare function createSigner(privateKeyPem: string): ReceiptSigner;
+export declare function loadSignerFromFile(path: string): ReceiptSigner;
+export interface ReceiptWriterOptions {
+    path: string;
+    signer?: ReceiptSigner;
+    /** Default true. Only disable for tests of the raw chain. */
+    redact?: boolean;
+    now?: () => Date;
+}
+/** Default location: <projectRoot>/.profclaw/runs/<runId>/receipt.jsonl (env PROFCLAW_RECEIPT_PATH overrides). */
+export declare function defaultReceiptPath(projectRoot: string, runId: string, env?: NodeJS.ProcessEnv): string;
+export declare class ReceiptWriter implements ReceiptSink {
+    readonly path: string;
+    private seq;
+    private prev;
+    private ended;
+    private readonly signer?;
+    private readonly redact;
+    private readonly now;
+    constructor(options: ReceiptWriterOptions);
+    get lastHash(): string;
+    append<K extends ReceiptEventType>(type: K, data: ReceiptDataMap[K]): ReceiptEvent;
+}
+//# sourceMappingURL=receipt-writer.d.ts.map

package/dist/agents/receipt/receipt-writer.js

@@ -0,0 +1,186 @@
+/**
+ * Receipt writer: append-only JSONL, canonical JSON, SHA-256 hash chaining,
+ * secret redaction before hashing, optional Ed25519 signature on run_end.
+ * Spec: docs/specs/run-receipt-v0.md
+ */
+import { createHash, createPrivateKey, createPublicKey, sign as edSign } from 'node:crypto';
+import { appendFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { GENESIS_HASH, RECEIPT_VERSION } from './receipt-types.js';
+// Canonical JSON
+/** Sorted keys, no whitespace, `undefined` members dropped, non-finite numbers rejected. */
+export function canonicalJson(value) {
+    if (value === null)
+        return 'null';
+    switch (typeof value) {
+        case 'string':
+        case 'boolean':
+            return JSON.stringify(value);
+        case 'number':
+            if (!Number.isFinite(value))
+                throw new Error('canonicalJson: non-finite number');
+            return JSON.stringify(value);
+        case 'object': {
+            if (Array.isArray(value)) {
+                return `[${value.map((v) => (v === undefined ? 'null' : canonicalJson(v))).join(',')}]`;
+            }
+            const obj = value;
+            const parts = [];
+            for (const key of Object.keys(obj).sort()) {
+                if (obj[key] === undefined)
+                    continue;
+                parts.push(`${JSON.stringify(key)}:${canonicalJson(obj[key])}`);
+            }
+            return `{${parts.join(',')}}`;
+        }
+        default:
+            throw new Error(`canonicalJson: unsupported type ${typeof value}`);
+    }
+}
+export function sha256Hex(input) {
+    return createHash('sha256').update(input).digest('hex');
+}
+/** Hash of an event: canonical JSON without `hash` and `signature`. */
+export function computeEventHash(event) {
+    const rest = { ...event };
+    delete rest['hash'];
+    delete rest['signature'];
+    return sha256Hex(canonicalJson(rest));
+}
+// Redaction
+export const REDACTED = '[REDACTED]';
+const SECRET_NAME = /(KEY|TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIAL)/i;
+const TOKEN_PATTERNS = [
+    /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,
+    /\bsk-[A-Za-z0-9_-]{16,}/g,
+    /\bgh[pousr]_[A-Za-z0-9]{20,}/g,
+    /\bgithub_pat_[A-Za-z0-9_]{20,}/g,
+    /\bxox[abprs]-[A-Za-z0-9-]{10,}/g,
+    /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g,
+    /\bAIza[0-9A-Za-z_-]{30,}/g,
+    /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g,
+    /\bnpm_[A-Za-z0-9]{30,}/g,
+];
+const BEARER = /\b(Bearer\s+)[A-Za-z0-9._~+/=-]{12,}/gi;
+/** NAME=value or NAME: value, where NAME looks like a secret variable. */
+const ENV_ASSIGN = /\b([A-Z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIALS?)[A-Z0-9_]*)(\s*[=:]\s*)("[^"\n]*"|'[^'\n]*'|[^\s"',;]+)/g;
+export function redactString(input) {
+    let out = input;
+    for (const re of TOKEN_PATTERNS)
+        out = out.replace(re, REDACTED);
+    out = out.replace(BEARER, `$1${REDACTED}`);
+    out = out.replace(ENV_ASSIGN, (match, name, sep, value) => value === REDACTED || value === `"${REDACTED}"` ? match : `${name}${sep}${REDACTED}`);
+    return out;
+}
+/** Deep-redacts strings and values under secret-looking object keys. Returns the changed flag. */
+export function redactValue(value) {
+    if (typeof value === 'string') {
+        const next = redactString(value);
+        return { value: next, changed: next !== value };
+    }
+    if (Array.isArray(value)) {
+        let changed = false;
+        const out = value.map((item) => {
+            const r = redactValue(item);
+            changed = changed || r.changed;
+            return r.value;
+        });
+        return { value: out, changed };
+    }
+    if (value !== null && typeof value === 'object') {
+        let changed = false;
+        const out = {};
+        for (const [key, v] of Object.entries(value)) {
+            if (SECRET_NAME.test(key) && typeof v === 'string' && v !== '' && v !== REDACTED) {
+                out[key] = REDACTED;
+                changed = true;
+                continue;
+            }
+            const r = redactValue(v);
+            changed = changed || r.changed;
+            out[key] = r.value;
+        }
+        return { value: out, changed };
+    }
+    return { value, changed: false };
+}
+/** Signer from a PKCS8 PEM Ed25519 private key. */
+export function createSigner(privateKeyPem) {
+    const privateKey = createPrivateKey(privateKeyPem);
+    if (privateKey.asymmetricKeyType !== 'ed25519')
+        throw new Error('Receipt signing key must be Ed25519');
+    const publicKey = createPublicKey(privateKey).export({ type: 'spki', format: 'der' }).toString('base64');
+    return {
+        publicKey,
+        sign: (hash) => edSign(null, Buffer.from(hash, 'utf-8'), privateKey).toString('base64'),
+    };
+}
+export function loadSignerFromFile(path) {
+    return createSigner(readFileSync(path, 'utf-8'));
+}
+/** Default location: <projectRoot>/.profclaw/runs/<runId>/receipt.jsonl (env PROFCLAW_RECEIPT_PATH overrides). */
+export function defaultReceiptPath(projectRoot, runId, env = process.env) {
+    const override = env['PROFCLAW_RECEIPT_PATH']?.trim();
+    return override ? override : join(projectRoot, '.profclaw', 'runs', runId, 'receipt.jsonl');
+}
+export class ReceiptWriter {
+    path;
+    seq = 0;
+    prev = GENESIS_HASH;
+    ended = false;
+    signer;
+    redact;
+    now;
+    constructor(options) {
+        this.path = options.path;
+        this.signer = options.signer;
+        this.redact = options.redact ?? true;
+        this.now = options.now ?? (() => new Date());
+        mkdirSync(dirname(this.path), { recursive: true });
+        // Append-only and one receipt per file: refuse to extend an existing file.
+        if (existsSync(this.path))
+            throw new Error(`Receipt already exists: ${this.path}`);
+        writeFileSync(this.path, '', { flag: 'wx' });
+    }
+    get lastHash() {
+        return this.prev;
+    }
+    append(type, data) {
+        if (this.ended)
+            throw new Error('Receipt already ended (run_end written)');
+        let payload = data;
+        if (this.redact) {
+            const r = redactValue(data);
+            payload = r.value;
+            if (type === 'tool_call' && r.changed) {
+                payload['redacted'] = true;
+            }
+        }
+        const base = {
+            v: RECEIPT_VERSION,
+            seq: this.seq,
+            ts: this.now().toISOString(),
+            type,
+            data: payload,
+            prev: this.prev,
+        };
+        const hash = computeEventHash(base);
+        const event = { ...base, hash };
+        if (type === 'run_end' && this.signer) {
+            const signature = {
+                alg: 'ed25519',
+                publicKey: this.signer.publicKey,
+                sig: this.signer.sign(hash),
+            };
+            event['signature'] = signature;
+        }
+        // Canonical text per line; hash and signature are members like any other.
+        appendFileSync(this.path, `${canonicalJson(event)}\n`, 'utf-8');
+        this.seq++;
+        this.prev = hash;
+        if (type === 'run_end')
+            this.ended = true;
+        return event;
+    }
+}
+//# sourceMappingURL=receipt-writer.js.map

package/dist/agents/result-store.d.ts

@@ -32,6 +32,12 @@ export declare class ResultStore {
      * Delete all temp files created during this session.
      */
     cleanup(): Promise<void>;
+    /**
+     * Remove stale result directories (e.g. from crashed runs) older than the TTL.
+     * TTL comes from PROFCLAW_RESULT_STORE_TTL_MS (default 24h). Returns the
+     * number of directories removed. Never throws.
+     */
+    static sweepStale(ttlMs?: number, baseDir?: string, now?: number): Promise<number>;
     private writeTempFile;
 }
 //# sourceMappingURL=result-store.d.ts.map

package/dist/agents/result-store.js

@@ -5,7 +5,7 @@
  * inline size limit. This prevents context windows from being flooded by
  * large tool outputs (e.g. file reads, API dumps).
  */
-import { writeFile, unlink, mkdir } from "node:fs/promises";
+import { writeFile, unlink, mkdir, readdir, rm, stat } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { randomUUID } from "node:crypto";
@@ -16,11 +16,17 @@ const MAX_INLINE_SIZE = 50_000;
 const MAX_TOTAL_SIZE = 5_000_000;
 /** Number of chars to include in the inline preview */
 const PREVIEW_LENGTH = 500;
+const TEMP_DIR_PREFIX = "profclaw-results-";
+/** Stale temp dir TTL, env-configurable (PROFCLAW_RESULT_STORE_TTL_MS, default 24h) */
+function getResultStoreTtlMs() {
+    const parsed = Number.parseInt(process.env.PROFCLAW_RESULT_STORE_TTL_MS ?? "", 10);
+    return Number.isFinite(parsed) && parsed > 0 ? parsed : 24 * 60 * 60 * 1000;
+}
 export class ResultStore {
     results = new Map();
     tempDir;
     constructor(sessionId) {
-        this.tempDir = join(tmpdir(), `profclaw-results-${sessionId}`);
+        this.tempDir = join(tmpdir(), `${TEMP_DIR_PREFIX}${sessionId}`);
     }
     /**
      * Store a tool result. Small results stay inline; large results spill to
@@ -93,6 +99,41 @@ export class ResultStore {
             count: deletions.length,
         });
     }
+    /**
+     * Remove stale result directories (e.g. from crashed runs) older than the TTL.
+     * TTL comes from PROFCLAW_RESULT_STORE_TTL_MS (default 24h). Returns the
+     * number of directories removed. Never throws.
+     */
+    static async sweepStale(ttlMs = getResultStoreTtlMs(), baseDir = tmpdir(), now = Date.now()) {
+        let removed = 0;
+        try {
+            const entries = await readdir(baseDir);
+            for (const name of entries) {
+                if (!name.startsWith(TEMP_DIR_PREFIX))
+                    continue;
+                const dir = join(baseDir, name);
+                try {
+                    const info = await stat(dir);
+                    if (!info.isDirectory() || now - info.mtimeMs <= ttlMs)
+                        continue;
+                    await rm(dir, { recursive: true, force: true });
+                    removed++;
+                }
+                catch (err) {
+                    logger.warn("[ResultStore] Failed to sweep stale dir", {
+                        dir,
+                        error: err instanceof Error ? err.message : String(err),
+                    });
+                }
+            }
+        }
+        catch (err) {
+            logger.warn("[ResultStore] Stale sweep failed", {
+                error: err instanceof Error ? err.message : String(err),
+            });
+        }
+        return removed;
+    }
     async writeTempFile(toolCallId, content) {
         await mkdir(this.tempDir, { recursive: true });
         const fileName = `${toolCallId}-${randomUUID()}.json`;

package/dist/agents/session-diff.d.ts

@@ -40,4 +40,10 @@ export declare class SessionDiffTracker {
  * Returns the process-level singleton SessionDiffTracker.
  */
 export declare function getSessionDiffTracker(): SessionDiffTracker;
+/**
+ * Produce a minimal edit script using the Myers diff algorithm.
+ * Returns an array of [type, line] tuples where type is '+', '-', or '='.
+ */
+/** Myers shortest edit script. Exported for tests. */
+export declare function shortestEditScript(oldLines: string[], newLines: string[]): Array<['+' | '-' | '=', string]>;
 //# sourceMappingURL=session-diff.d.ts.map

package/dist/agents/session-diff.js

@@ -176,7 +176,8 @@ function renderHunk(hunk) {
  * Produce a minimal edit script using the Myers diff algorithm.
  * Returns an array of [type, line] tuples where type is '+', '-', or '='.
  */
-function shortestEditScript(oldLines, newLines) {
+/** Myers shortest edit script. Exported for tests. */
+export function shortestEditScript(oldLines, newLines) {
     const n = oldLines.length;
     const m = newLines.length;
     const max = n + m;
@@ -211,38 +212,28 @@ function shortestEditScript(oldLines, newLines) {
     const edits = [];
     let x = n;
     let y = m;
-    for (let d = trace.length - 1; d >= 0 && (x > 0 || y > 0); d--) {
+    for (let d = trace.length - 1; d >= 0; d--) {
         const vPrev = trace[d];
         const k = x - y;
-        const ki = k + max;
-        let prevK;
-        if (k === -d || (k !== d && vPrev[ki - 1] < vPrev[ki + 1])) {
-            prevK = k + 1;
-        }
-        else {
-            prevK = k - 1;
-        }
+        const down = k === -d || (k !== d && vPrev[k - 1 + max] < vPrev[k + 1 + max]);
+        const prevK = down ? k + 1 : k - 1;
         const prevX = vPrev[prevK + max];
         const prevY = prevX - prevK;
-        while (x > prevX + 1 && y > prevY + 1) {
+        // Follow the diagonal (matching lines) back to where this round's edit ended.
+        while (x > prevX && y > prevY) {
             edits.unshift(['=', oldLines[x - 1]]);
             x--;
             y--;
         }
         if (d > 0) {
-            if (x > prevX && y > prevY) {
-                edits.unshift(['=', oldLines[x - 1]]);
-                x--;
+            if (down) {
+                edits.unshift(['+', newLines[y - 1]]);
                 y--;
             }
-            else if (x > prevX) {
+            else {
                 edits.unshift(['-', oldLines[x - 1]]);
                 x--;
             }
-            else if (y > prevY) {
-                edits.unshift(['+', newLines[y - 1]]);
-                y--;
-            }
         }
     }
     while (x > 0) {